Options: mail, contact addresses and network

Mail and SMTP

Option	Default	Effect
Smtp:Host	(empty)	empty = no mail dispatch. Sign-in then carries on through a password; invoice dispatch and member invitations fall away
Smtp:Port / Smtp:UseStartTls	587 / true
Smtp:User / Smtp:Password	(empty)	credentials; these belong in the environment, not in a file in the program directory
Smtp:From / Smtp:FromName	no-reply@docuflair.com / Invoiceflair	the sender of sign-in and invitation mail — change this to your own domain
Smtp:InvoiceFrom / Smtp:InvoiceFromName	invoice@docuflair.com / Invoiceflair	a separate sender for invoice mail from the archive. That mailbox needs SPF/DKIM just like the default sender
Smtp:ReplyTo	support@docuflair.com	the reply address; empty = none

There are two sender addresses, not one

From for sign-in and invitations, InvoiceFrom for invoice mail from the archive. Anyone who changes only the first keeps sending customer invoices from a Docuflair address — and runs into SPF problems.

Sign-in

Option	Default	Effect
MagicLinkTtlMinutes	15	the validity of a sign-in link (usable once)
SessionDays	30	the sliding lifetime of the sign-in cookie
LoginRequestsPerEmailPerHour	5	open sign-in requests per address and hour

Contact addresses

Option	Default	Effect
SupportEmail	support@docuflair.com	the target of the “Report a problem” link on the result pages; the link carries the event identifier of the operation. Empty = the link is hidden
EnterpriseContactTo	support@docuflair.com	the recipient of enquiries from the Enterprise page

EnterpriseContactTo has to remain a real mailbox

Without SMTP the page falls back to a mailto: link — the address is then visible to the visitor and addressed by their mail program.

CORS and proxies

Option	Default	Effect
AllowedOrigins	(empty)	empty = no cross-origin access. The interface is same-origin and the JSON API is server-to-server; register specific browser clients here
KnownProxies	(empty)	the addresses of trusted reverse proxies for X-Forwarded-For/-Proto. Loopback is trusted in any case

As an environment variable, lists carry an index: InvoiceApi__KnownProxies__0.

Without KnownProxies, all clients behind a proxy look alike

Rate limiting and the log then partition by the proxy’s address. See Running behind a reverse proxy.

Values verified against the code on 22 October 2026.